HooRii Privacy Policy

Effective date: 19 October 2026

Last updated: 19 October 2026

HooRii Technology (HK) Limited ("HooRii", "we", "us" or "our") operates the HooRii mobile and web applications, https://hoorii.io and related services (the "Services"). This Policy explains the personal information we collect, how we use and disclose it, where it is stored, and the choices available to you.

Our principal markets are the United States and South Korea, with users in other regions worldwide. We do not offer the Services to users in mainland China. You can contact our Customer Support Department at contact@hoorii.io about this Policy or your personal information.

1 Information we collect

Account and profile information

We collect your email address and process your password to create and authenticate your account. We support email-and-password login. We do not currently offer Google or Apple sign-in.

A nickname is required. Your city or region and preferred language are optional. You enter your city or region manually; this profile field does not obtain your location through device location permission. We do not currently request gender, pronouns, education or employment status as profile fields. There is currently no age-confirmation step at registration.

Conversations and other content

We process text messages, audio submitted for speech-to-text conversion, and images or files you choose to upload or capture. Relevant conversation history and AI memory help generate personalized replies. Chat history and AI memory are stored on your device, and a limited recent-chat copy is also stored on our servers for synchronization. Relevant context may be sent to our AI providers as described in Sections 3 and 5.

Creative Workshop content includes character names, avatars, introductions, character settings, prompts, animations and voice identifiers or configurations. Creative Workshop does not store audio files as part of a character.

If you contact support, we receive your correspondence and any materials you voluntarily submit, such as screenshots, conversation excerpts or attachments. When providing another person's personal information, you must have an appropriate lawful basis and obtain any consent required by applicable law.

Orders and entitlements

Apple App Store and Google Play process purchases and subscriptions through their own payment systems. We receive only order-related information, such as order or transaction identifiers, purchased products, amounts, purchase times and subscription status, to verify purchases and manage subscriptions and entitlements. We do not directly receive payment-card numbers, card security codes or complete payment-account information. We also maintain applicable records of purchased features and rewards earned or used.

Technical logs and essential storage

Our servers and infrastructure record basic technical logs, such as IP addresses, request times, requested interface paths and error information, for operation, troubleshooting and security. The precise recorded fields depend on the infrastructure configuration.

We do not currently use website or App usage-analytics tools, crash-monitoring tools, advertising pixels, remarketing tools or advertising-attribution SDKs. We do not collect click, button-interaction or page-visit statistics for behavioral or trend analysis.

We use cookies, browser local storage and similar technologies for essential functions, including maintaining login sessions and remembering language choices and user settings. We do not use them for advertising tracking or usage analytics. You can manage or remove cookies and site data in your browser settings. Doing so may sign you out, reset preferences or prevent related functions from working. Specific expiry periods vary with the technology and configuration; we do not state a single confirmed expiry period for all such storage.

Device permissions

The App requests access to the relevant device function when you use it: microphone access for voice input and transcription; photo selection or photo-library access to choose images; camera access to capture images; and file access or selection to upload files. You can manage applicable permissions in your device settings. Refusing or revoking permission may prevent the corresponding feature from working.

2 How we use information

We use information to create and administer accounts, authenticate users, provide AI conversations and personalization, synchronize recent messages, host Creative Workshop content, process support requests, administer purchases and entitlements, operate and secure the Services, and meet applicable legal requirements.

We do not use conversations, audio or AI memory to train or fine-tune our own models, analyze user behavior, improve product features, or develop marketing strategies. Personalization uses relevant context and saved memory; it does not mean we train our own models on your content. We do not use or disclose conversation content, audio, AI memory or other content submitted within the Apps for marketing or advertising.

Employees review conversation content, audio or AI memory only when you voluntarily submit that content for support and only to handle your request, including troubleshooting or a reported safety issue. We do not routinely sample this content for quality assessment or remotely inspect device history or memory for review. Authorized technical access to infrastructure does not itself authorize such content review.

Where the relevant law recognizes them, the processing grounds are contractual necessity for objectively necessary service delivery; qualifying legal obligations for required compliance; and legitimate interests for necessary and proportionate security, troubleshooting or legal-claims activities, subject to your rights and interests. Consent is required where applicable law requires it. Sensitive-information and international-transfer conditions apply separately. A contractual or legitimate-interest label does not override them. A foreign legal demand does not automatically qualify as a GDPR legal obligation.

Marketing emails

Under our current registration process, accounts are subscribed to promotional emails by default. You can unsubscribe free of charge through the link in a promotional email or by contacting contact@hoorii.io. Necessary service messages, including verification, transaction and security messages, may continue. A separate optional marketing opt-in process is not currently implemented. Registration or receipt of this Policy must not be treated as satisfying any affirmative consent requirement imposed by applicable law.

Sensitive personal information

Sensitive information can include health information, sex life or sexual orientation, religious or political beliefs, and other information specially protected under applicable law. Please avoid submitting sensitive information that is unnecessary for the feature you use.

Our AI-memory extraction mechanism excludes sensitive information from being saved as personalized memory. However, sensitive information you enter may remain in chat history, the recent server synchronization copy or support materials you submit, and may be included in context sent to an AI provider to generate a reply.

There is currently no separate sensitive-information consent step. This Policy, voluntary submission of information, and use of the Services do not substitute for separate or explicit consent where required by law. You may contact us about restricting or deleting such information. Excluding information from saved memory does not, by itself, establish a lawful basis for processing it elsewhere.

3 How we disclose information

Hosting and operational providers

We use Google Cloud hosting in Singapore for the server information described in Sections 5 and 6. We may also use providers for information technology, customer support and email delivery, including delivery of our own promotional emails. These operational disclosures are separate from advertising-partner disclosures. Provider-specific contracting entities, privacy contacts and some processing or retention arrangements have not all been verified.

AI and speech providers

Google Gemini through Google Cloud Vertex AI receives relevant conversation context, including portions of history and AI memory, to generate responses. Our configured location is Singapore, asia-southeast1. We do not enable Grounding with Google Search or customer-configured logging of full prompts and responses to BigQuery or similar storage. We have not confirmed all model-specific processing-location commitments, provider-side monitoring or caching retention, or any customer training permissions. We do not promise Singapore-only processing or zero retention by Google.

Deepgram receives audio for speech-to-text conversion through api.deepgram.com, its global endpoint. We set mip_opt_out=true on each request to exclude submitted content from its Model Improvement Program. According to Deepgram's published documentation, opted-out audio and transcripts are retained only as needed to process the request. Request metadata and usage logs, which do not contain audio or transcripts, are handled separately: they are retrievable for 90 days, and summarized usage may be retained longer. The global endpoint does not provide a single-country residency guarantee; actual destination countries have not been confirmed. See https://developers.deepgram.com/trust-security/your-data.

ElevenLabs receives text to generate speech. We use an ordinary account with the default SDK environment, without an isolated regional residency environment. Its documentation describes standard customer-data hosting/storage in the United States; this does not guarantee that all processing occurs there. We do not use voice cloning and have disabled model-training/improvement data sharing. This is not Zero Retention Mode. Applicable retention periods, deletion arrangements and any further processing countries have not been confirmed. See https://elevenlabs.io/docs/overview/administration/data-residency.

Apple App Store and Google Play handle payment information under their own privacy terms and supply the order information described in Section 1.

Creative Workshop publication

Characters are private by default. If you actively publish a character, other users can view its name, avatar, introduction, character settings, prompts, animations, selected voice and your author nickname. Voice selection is stored as an identifier or configuration, not an audio file.

Review all fields before publishing and remove information you do not wish to disclose. You can delete character content, including published content; account deletion also removes it from active systems as described in Section 6. Recoverable copies may remain in backups. Downloading characters for use is a planned feature, not a current capability described by this Policy.

Other disclosures

We may disclose relevant information to professional advisers where necessary for their services; to competent authorities or others where permitted or required by applicable law for compliance and protection of legal rights; and in connection with due diligence, a reorganization, sale, merger, insolvency or transfer of the business, subject to applicable requirements and safeguards.

We do not sell or rent users' personal information or provide it to other businesses for their own marketing, data trading or profiling in exchange for money or other benefits. We do not currently disclose information collected through advertising-tracking tools for targeted advertising. The legal classification of operational-provider disclosures depends on actual processing and contractual safeguards, rather than the service-provider label alone.

4 Security

We use encrypted connections, including HTTPS/TLS, between the Apps or Website and our servers and between our Services and third-party AI and speech providers. This is encryption in transit, not a representation of end-to-end encryption.

Access to servers and databases is restricted to authorized personnel, with permissions assigned according to work responsibilities and need. Protect your password and device and avoid sharing account access. No system or transmission method can be guaranteed completely secure.

If a personal-data security incident occurs, we will investigate, assess its impact and take appropriate remedial measures. Where applicable law requires notification to regulators or affected individuals, we will notify within the required timeframe and provide the information and protective recommendations required by law.

5 Storage and international processing

Our Google Cloud servers are in Singapore. They store account information, settings, ordinary images/files, Creative Workshop content and the limited recent-chat synchronization copy. Uploaded user audio is temporary transcription input and is deleted after transcription completes. We do not maintain our own servers or backups containing these records in other countries. Recoverable copies exist in Singapore as described in Section 6.

Chat history and AI memory are stored on your device. A server copy of recent chat messages supports synchronization: only messages within the latest 3 days, capped at the latest 200 messages, remain in active synchronization storage. AI memory is not stored on our servers as synchronization data. Relevant history and memory may nevertheless leave the device as context for third-party response generation.

Authorized personnel may remotely access relevant servers, databases or support materials from Hong Kong and Singapore, subject to the limits in Sections 2 and 4. This does not change the server-storage location.

Provider processing is separate from our Singapore hosting. Deepgram uses a global endpoint; ElevenLabs uses its standard environment with documented United States storage; and Google processing depends on the applicable model, endpoint and features. Not all onward-processing countries and recipient details have been confirmed. We do not claim all user information stays in Singapore.

6 Retention and deletion

The following periods describe active systems. Backup residuals, device copies and independent provider records are separate.

Account deletion

Request deletion at contact@hoorii.io. After identity verification is complete, we complete account deletion and delete associated account, order, synchronization, image/file, setting and Creative Workshop data from active systems within 1-3 business days, subject to applicable legal-retention requirements. All Creative Workshop content, including published content, is included. Uploaded audio follows the earlier transcription-completion deletion rule.

Support correspondence is subject to the current ongoing-retention practice above; contact us to request its deletion. We will assess and handle such requests under applicable law. Where records must be retained by law, we retain the necessary records for that obligation and limit their use accordingly. Specific statutory periods depend on the applicable record and requirement.

Backups and recoverable copies

Our Singapore environment contains backups, snapshots or other recoverable copies that are currently retained long-term without a fixed maximum deletion period. We have not implemented a 30-day rolling deletion policy. Deletion from active systems therefore does not mean all backup copies are erased within the active-system deadline. Access remains subject to the authorization controls described in Section 4. Contact us about deletion requests affecting recoverable copies.

Device and provider copies

Account deletion through support does not automatically erase local history or AI memory. You can ask the AI to correct or individually delete a saved memory, which updates the underlying stored data. This does not separately delete chat messages containing the same information. To remove all local history and memory, clear the App's data or uninstall it. Device or operating-system backup copies may require separate removal; their exact behavior has not been confirmed.

Our deletion deadlines do not determine when Google, Deepgram, ElevenLabs or the app stores delete their records. Their processing and retention are separate, as described in Section 3. Disabling model-training sharing does not automatically remove logs or all retained provider data.

7 Your choices and requests

Contact Customer Support at contact@hoorii.io to ask about collection and use, request access or a copy, correct or delete information, withdraw applicable consent, or make a privacy complaint. We may verify your identity proportionately and will handle legally required requests within applicable deadlines, subject to lawful exceptions and others' rights. We will not unlawfully discriminate against you for exercising privacy rights.

You can request an export of chat history and AI memory through an AI conversation in the App. This reads the actual available stored data and provides copyable text or a downloadable file; it does not merely summarize current context or recover deleted records. You can also ask the AI to correct or delete individual saved memory entries.

Support can handle requests concerning account information and recent chat records still held on our servers. Creative Workshop has no current export function. That limitation does not remove any legally required access, copy or portability right: submit the request to support. Where legally required, we will provide relevant information in a portable, machine-readable, readily usable format.

You may unsubscribe from promotional emails as described in Section 2. We have no current advertising-tracking opt-out setting because we do not currently conduct the advertising-tracking activities described in Section 3. If such practices change, applicable notices, consent and opt-out requirements must be addressed before they begin.

Withdrawal of consent does not affect the lawfulness of processing before withdrawal. Where required by applicable law, you may use an authorized agent or appeal a request denial through the same contact address. We will explain applicable reasons for denial and appeal procedures. You may also complain to the competent regulator where the relevant law provides that right.

8 Regional information

South Korea

Where South Korea's Personal Information Protection Act applies, overseas provision, entrusted processing, storage and remote access require an applicable legal basis. Our currently identified flows include Google Cloud hosting in Singapore; authorized HooRii access from Hong Kong and Singapore; Gemini conversation processing through the configured Singapore Vertex AI location; Deepgram speech-to-text through its global endpoint; and ElevenLabs synthesis using standard United States storage. Sections 1, 3, 5 and 6 describe the information, purposes and currently known retention arrangements.

Our current overseas-transfer notice is provided through this Policy, without a separate transfer-consent step. Some recipient contracting entities, contacts, destination countries and provider retention arrangements remain unconfirmed. This Policy does not itself establish that all required transfer disclosures or legal conditions have been met. In particular, the contract-necessary entrusted-processing/storage route applies only if its legal conditions and required disclosure or notification requirements are fulfilled. Where separate consent is legally required, general acceptance of this Policy is not a substitute.

Contact contact@hoorii.io to request transfer information or exercise applicable rights, including refusal or withdrawal where a transfer relies on consent. Any resulting feature impact depends on whether the feature can operate without the transfer and whether another lawful basis applies.

United States

State-law rights apply where the relevant law covers our processing. These may include access, correction, deletion, portability and opt-out or consent rights for covered activities, together with authorized-agent, appeal and non-discrimination protections. Submit requests through Section 7. Our current sale/rental and advertising practices are described in Section 3. We do not represent that every United States state privacy law applies to us or that failure to meet one law's thresholds creates an exemption from all others.

European Economic Area and United Kingdom

Where EU or UK data-protection law applies, HooRii Technology (HK) Limited is the controller. The purposes and conditional processing grounds appear in Section 2. Sensitive-information processing and international transfers require their own applicable additional conditions. Rights include those available under the relevant law and the right to complain to a competent supervisory authority.

An applicable transfer mechanism and any necessary supplementary safeguards must support covered international transfers. We do not represent that unverified standard contractual clauses, UK transfer instruments or local representative appointments are already in place. Contact us for information about the arrangements applicable to your data.

9 Age requirements

The Services are not intended for and may not be used by anyone under 16. Individuals aged 16 or 17 may use them only where local law permits. Any higher local minimum age or required parental/guardian consent must be satisfied. Registration currently has no age-confirmation step; this restriction is a service eligibility rule, not a claim that age verification is implemented.

If we learn that an account does not meet applicable age or consent requirements, we will stop access and take appropriate steps concerning the account and personal information, subject to applicable law. Contact contact@hoorii.io if you believe an underage person has provided information. Local device records and recoverable copies have the limitations described in Section 6.

10 Policy changes

We may update this Policy as the Services, data practices or laws change. Published versions will identify their update and effective dates. For material changes affecting data collection, use, disclosure or privacy rights, we will notify your registered email address before the changes take effect. Where a change requires consent by law, we will obtain that consent before the relevant processing. Notice or continued use does not replace legally required consent.

11 Language

This Policy may be provided in multiple languages. If versions differ, the English version prevails to the extent permitted by applicable law. This does not limit mandatory local protections or legally required local-language notices or information.

12 Contact

HooRii Technology (HK) Limited. Responsible department: Customer Support Department. Email: contact@hoorii.io. Correspondence address: Rm.1002, 10/F, Easey Comm. Bldg., 253-261 Hennessy Road, Wanchai, Hong Kong.